MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c3cfdc7509a3dddc8fe0d0a46932678acaca3f91db59929bc6d4738a37a3b9d2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	c3cfdc7509a3dddc8fe0d0a46932678acaca3f91db59929bc6d4738a37a3b9d2
SHA3-384 hash:	23a617174858a009c4eb5b11702f16f4833e0b8d8042ee3d1ed8942ff3798fcadc4eff99686ed00d08f96910e9d9fa07
SHA1 hash:	11c1c0447eaa7d06d3ca9a580132a248a88ec4cf
MD5 hash:	d0c854ec586c654f71ea27b04cb79111
humanhash:	autumn-pasta-charlie-berlin
File name:	wget.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'228 bytes
First seen:	2026-01-04 19:28:57 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	24:6j+ELbMsVEcGLNIZEtHDEVKT0CEHZ/EOFELF9S5P3E3e+bEKCeEz3gE1FdEk8jn:g14EQ6BF2S5EeO4rJ8j
TLSH	T15821F2CF6074B96A5048CF4131E216C975F8CAE5E6708E279E9478F785C86073638EDB
Magika	txt
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://130.12.180.28/Fantazy/Fantazy.arm4	5f4ead21261a4872c7bbdc341a3cab2d09a881bc1ca20a78f3cbe3800cd54f0d	Mirai	elf mirai
http://130.12.180.28/Fantazy/Fantazy.arm5	9df7c2bebdee16b4907509ea8cdfc4128a8c2c0fb21156ed8105db2cf8f4ecf2	Mirai	elf mirai
http://130.12.180.28/Fantazy/Fantazy.arm6	9c6625a0a04aee9ac1fe10d55edc2f0aa77f66593916a10cb8314ad29457edeb	Mirai	elf mirai
http://130.12.180.28/Fantazy/Fantazy.arm7	48b94eff6e2031ce3fd8f0c605917b5a55b26a2d9e1800b9612758189e794631	Mirai	elf mirai
http://130.12.180.28/Fantazy/Fantazy.m68k	4b6f0caf42dc42e3f8f4e7adc9a93435cb27d604df131e19503be23fbc955826	Mirai	elf mirai
http://130.12.180.28/Fantazy/Fantazy.mips	9997ba3aad89be8f8371620b5b841eaa71da6f32368d84363bab6dd57303929c	Mirai	elf mirai
http://130.12.180.28/Fantazy/Fantazy.mpsl	eeb8b37ab92777cbe5c49834cc044393207e0b745a0e2d0806b7da4e6292000b	Mirai	elf mirai
http://130.12.180.28/Fantazy/Fantazy.ppc	1f0a93ffbe48da5f9d8188060be1d5ce128fdc1545c2077a22bff830b19302cf	Mirai	elf mirai
http://130.12.180.28/Fantazy/Fantazy.sh4	69a6fc590d0f527d1c6e04a9cf1c84eb52ca88de7867e8e8cf31b0b67d94eb70	Mirai	elf mirai
http://130.12.180.28/Fantazy/Fantazy.spc	d1d3129a68b9da3ed82981110c4d48721d47a176134b004e4e34544d1e2b1cd9	Mirai	elf mirai
http://130.12.180.28/Fantazy/Fantazy.x86	ad613cf0f480c1c00f15379fc0df01af6d6c14309c9d0e452bd5e71ec6342c0f	Mirai	elf mirai
http://130.12.180.28/Fantazy/Fantazy.x86_64	5443d764e399f0cd44ef17ea0940db73fc635045faa26f0ce8a4d8b3453b5988	Mirai	elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

mirai

Link:

https://www.filescan.io/uploads/695abf8c2fb7bb52ca86cf3c/reports/c59831a4-5a34-4df9-a75c-73c6c2981bae/overview

Verdict:

Malicious

File Type:

text

First seen:

2026-01-04T16:35:00Z UTC

Last seen:

2026-01-04T18:48:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.cl

Link:

https://opentip.kaspersky.com/c3cfdc7509a3dddc8fe0d0a46932678acaca3f91db59929bc6d4738a37a3b9d2/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/4ddec6b1-e763-4a37-a1aa-f38a3c11e415

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/c3cfdc7509a3dddc8fe0d0a46932678acaca3f91db59929bc6d4738a37a3b9d2

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c3cfdc7509a3dddc8fe0d0a46932678acaca3f91db59929bc6d4738a37a3b9d2/

Verdict:

Malicious

Threat:

Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/c3cfdc7509a3dddc8fe0d0a46932678acaca3f91db59929bc6d4738a37a3b9d2

Threat name:

Script.Trojan.Heuristic

Status:

Malicious

First seen:

2026-01-04 19:29:18 UTC

File Type:

Text (Shell)

AV detection:

10 of 24 (41.67%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=yph5y5ijupo5zd7a2csgsmthrlfmup4r3nmzfg6g2rzyun5dxhja._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260106-jdztsaxqfx/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh